Every door is different. Pick how open — or how guarded — each door should be, and change it any time. The basics are free: phone verification, a member list, opening hours and a blocklist. Each option below says what the visitor sees, what you do, and which plan has it.
Each door starts open to anyone who verifies their phone. Or limit it to your member list.
Places where anyone is welcome during opening hours
Visitor: Scans the QR, types their number and the 6-digit code we text them, and gets the door code (or the door opens). Next time their phone is remembered (90 days unless you change it in Settings → Visitor page).
You: Nothing to set up. Every entry is still phone-verified and logged with the last 4 digits.
Gyms, storage, clubs — any paid or listed membership
Visitor: Only phones on your member list get through; anyone else is refused before a code is sent.
You: Add members one by one or from a CSV, with optional start and end dates. Switch anyone off and it applies on their next scan.
Members plus visitors, under one of the walk-in rules above
Visitor: Members always get in. Everyone else goes through the door's walk-in rule.
You: Pick it on the door, then choose the walk-in rule. “Members always get in” can be switched off to send members through the same rule.
For people who aren't on your member list. Pick one per door, in the door's Rules tab.
Communities with familiar faces who aren't on a member list
Visitor: Gets in if their phone was let in within the last 12 months — at one of your doors, or at a door that checks people at another place of the same kind on QR Gate (places of worship with places of worship, gyms with gyms). A first-timer is refused.
You: Pick it on the door. Anyone let in at one of your doors, open ones included, counts here. Elsewhere, only entries that meant something count: a member's, or one through a door that checks people, at a place on a paid plan. Trust never crosses kinds of place, and goes quiet after 12 months away.
Letting people you know vouch for someone new
Visitor: A returning visitor gets in as usual. A first-timer types the code they were given (like TRUST-7X2K4M) with their number, verifies, and gets in — after that they're a returning visitor.
You: Issue codes on the Members page and share them. Every use is logged against the code and emailed to you; turn a code off any time.
Low-traffic or sensitive doors where a person decides
Visitor: Verifies their phone, then waits on the page while you decide. Their screen updates the moment you answer; a request expires after 5 minutes.
You: You get a push on the QR Gate admin app, an email and a card on the dashboard — tap approve or decline. Only phone-verified visitors ever reach you.
Ranges, clubs and spaces that need a real-world identity
Visitor: After verifying their phone, a newcomer photographs a driver's license, passport or ID card — and, if you choose, takes a live selfie that must match. Someone already checked anywhere on QR Gate isn't asked again.
You: Choose ID only, or ID plus selfie. Checked by Stripe Identity; we keep only the result, never the photos.
Cost: $2 per new person checked (passed or not), on your next invoice.
Hours and the blocklist apply to everyone. The rest are other ways in for people you name.
Doors open only at set times
Visitor: Outside the hours they're told the door is closed — members included.
You: Set fixed windows per door (overnight too). On Growth, let them follow your iqamah times, today's prayer times or sunrise to sunset. Your own closed message; the after-hours email is your choice.
When someone should no longer get in — at all
Visitor: Refused at every door, even if they're a member. They see the same refusal as anyone, never that they're blocked.
You: Block a number on the Members page. It beats every other rule.
Ranges, gyms, pools, workshops
Visitor: Signs your rules or waiver once on their phone — typed name and a tick — before getting the code. A new version asks again.
You: Write and publish the waiver, then see and export who signed which version, when and at which door.
Eid, an open day, a match day, a wedding
Visitor: If their number is on the list, they walk in for that event — past members-only and walk-in rules, even outside hours if you allow it.
You: Paste names and numbers, set the event's window and doors. The list ends on its own.
Members bringing a friend
Visitor: Gets a text from the member with a pass for the day, verifies their own phone and walks in.
You: Switch guest passes on and set how many a member can give. You see who invited whom.
Named people — contractors, tenants, renters, staff
Visitor: Opens their link, confirms their phone once, then taps to open the doors on it until it ends.
You: Issue a link for a member and some doors, with an end date or number of uses. Revoke it and it stops on the next tap.
Doors with a smart lock
Visitor: Gets their own code that expires on its own, or the door unlocks for them. If the lock is offline, they get your keypad code instead.
You: Connect a TTLock deadbolt or a SmartThings hub lock (no per-door fee), or a Wi-Fi Yale, Schlage, Kwikset or August through Seam — those give codes only.
Cost: Pro.
No. Any phone that can receive an SMS works — they scan the QR code, enter their number, and type the 6-digit code we text them. No downloads, no sign-ups, works internationally.
Yes, on Pro. TTLock keypad deadbolts and Z-Wave, Zigbee and Matter locks on a SmartThings hub connect directly; Wi-Fi Yale, Schlage, Kwikset and August locks connect through Seam and give each visitor their own code. No per-door fee for any of them. Home Assistant is coming soon — see the Door hardware page. Every option fails safe: if a remote unlock doesn't go through, the visitor gets your keypad code instead.
Yes, on Pro. Set a door to “Photo ID, once”: a newcomer checks a driver's license, passport or ID card with Stripe Identity (optionally with a live selfie), once. We keep only the result, never the photos. Each new person checked costs $2, added to your next invoice.
Yes, on Growth. Set a door to "Ask me each time" and every walk-in waits while you approve or decline — from the admin app, a live dashboard card or an email. Visitors verify their phone first, so you're never bothered by anonymous requests.
Deactivating a member takes effect on their next attempt. Blocking a number is stronger: it denies them at every location instantly, even if they're still on a member list, and they're never told they were blocked — they get the same "can't get in here right now" anyone refused does.
At the place that let them in, for 12 months. Elsewhere, only within the same kind of place — masajid and churches, gyms, ranges and clubs, storage, homes and rentals, co-working — and only from an entry that meant something: a member's, or one through a door that checks people, at a place on a paid plan. An open door vouches for no one elsewhere. Trust goes quiet after 12 months away. Your organization always has the final say: your blocklist beats any rule.
Your physical keypad keeps working regardless — QR Gate hands out codes; it doesn't sit between your lock and the door. For smart-lock setups, the SMS-code fallback covers connectivity hiccups.
Change it whenever you like, or on a schedule (daily or weekly) — you get an email with the new code to put on the keypad. Visitors always get the current one, and can report a code that didn't work.
As little as possible: phone numbers are stored as one-way hashes with only the last 4 digits kept for display. Access logs show who came in (last 4), where, when, and the result.
Yes — each location gets its own QR code, lock code, and rules. The free plan covers one location; Growth covers 10 and Pro is unlimited.
Ready to set up your first door — free, in about 15 minutes?